When an employee loses a work laptop, the first job is to cut the laptop off from your systems, not to find it. Reset the user’s password, revoke their signed-in sessions and block the device in Microsoft 365, then decide whether to wipe it, and record what was on it in case you need to tell the ICO within 72 hours.
Quick answer: Treat a lost work laptop as a live security incident from the moment it is reported. Within the first hour, reset the user’s password, revoke their Microsoft 365 sessions, disable the device in Microsoft Entra ID and send a remote wipe if the laptop is managed. Then work out what data it held, whether the disk was encrypted, and whether the loss must be reported to the ICO within 72 hours.
In this guide: the order to do things in, when a remote wipe helps and when it does not, how to decide whether the loss is a reportable breach, and what to set up now so the next lost laptop is an inconvenience rather than an incident.
What to do in the first hour
Most of the damage from a lost laptop comes from what is still signed in on it: Outlook, Teams, OneDrive, the browser with saved passwords. Cutting those sessions off matters more than anything you do to the hardware, and you can do it from any browser in a few minutes.
- Get the facts from the user. When and where they last had it, whether it was stolen or misplaced, whether it was locked or asleep, and whether a password was written down in the bag. Ask calmly. People who fear blame leave things out, and you need the honest version.
- Reset the user’s password. In the Microsoft 365 admin centre or Microsoft Entra admin centre, set a new password and tell the user in person or by phone, not by email to the inbox that was on the laptop.
- Revoke their sessions. On the user’s page in Microsoft Entra ID, select Revoke sessions. This stops the laptop getting new access tokens. Microsoft’s guidance on revoking user access notes that access tokens last for one hour by default, so some apps can keep working for up to an hour unless they support continuous access evaluation.
- Disable the device. Find the laptop under Devices in Microsoft Entra ID and disable it, so it can no longer present itself as a trusted company device.
- Send the remote action. If the laptop is enrolled in Intune, decide between locating it and wiping it (the next section covers that choice), and send the action now so it runs the moment the laptop next connects.
- Write down the time. Note when the loss was reported and what you did, minute by minute if you can. You will need this record whether or not anything goes to the ICO.
None of this depends on the laptop being found, and none of it needs the user to be disabled. They can carry on working on another machine once they have their new password, provided their multi-factor authentication method was on their phone rather than on the lost laptop.
Should you wipe the laptop straight away?
Usually yes, but it is worth thirty seconds of thought first, because a full wipe ends your options. Once a Windows laptop is factory reset, it drops out of management and you can no longer locate it through Intune. If there is a real chance it is sitting in a meeting room or on a colleague’s desk, a location check first may save you rebuilding a perfectly good machine.
The bigger catch is that a remote wipe only runs when the device is switched on and online. The NCSC’s guidance on erasing devices makes the same point: no power or no data connection, no wipe. A thief who never connects the laptop to a network is never reached by your wipe command. That is why encryption, not wiping, is the control that actually protects the data.
| Intune action | What it does on a lost Windows laptop |
|---|---|
| Locate device | Shows the laptop on a map, but only if a policy allowing location access was applied before it went missing. |
| Remote lock | Not available for Windows laptops in Intune at the time of writing. It covers Mac, iPhone, iPad and Android devices. |
| Wipe | Factory resets the laptop when it next connects. The option to continue even if power is lost overwrites free space and suits lost or stolen devices. |
| Retire | Removes company data and management but leaves personal data. Meant for devices being handed back, not for theft. |
Microsoft’s documentation on wiping devices describes the wipe that continues through power loss as the option for high-security cases such as lost or stolen devices, with a warning that it can occasionally leave a machine unable to start again. On a laptop you expect never to see again, that trade-off is easy.
If the laptop is not enrolled in any management tool, there is nothing to send. Your protection is then whatever was set up locally, which is the question the next section answers.
What can someone actually get from it?
The answer depends on two things: whether the disk was encrypted, and whether the data lived on the laptop or in the cloud. A laptop with BitLocker switched on, a sign-in PIN or password, and files kept in OneDrive or SharePoint gives a thief a piece of hardware and very little else. The same model with encryption off and a desktop full of exported spreadsheets is a different story.
| The laptop was… | What a finder or thief can realistically reach |
|---|---|
| Encrypted, locked, data in the cloud | Very little. Without the sign-in, the disk cannot be read, and cloud access has been revoked. |
| Encrypted, but asleep and unlocked | Whatever is open, plus anything the browser or apps are still signed in to, until you revoke sessions. |
| Encrypted, password in the bag | Everything. The ICO’s own encryption guidance gives this example and calls the encryption ineffective. |
| Not encrypted | Every local file, cached emails, and possibly saved browser passwords, by removing the drive. |
Two places catch people out. Outlook keeps a local copy of the mailbox, so years of email may be on the disk even if “everything is in the cloud”. And browsers that save passwords may hold logins for supplier portals, banking and social media accounts that have nothing to do with Microsoft 365. Ask the user which of those they used on the laptop, and change those passwords too.
Check BitLocker, do not assume it. In Intune, the device’s encryption status and recovery key are recorded against the device. If the record shows the disk was not encrypted, or the laptop was never enrolled, treat the data on it as exposed when you make the reporting decision.
Is a lost laptop a reportable breach?
A lost laptop holding personal data is a personal data breach under UK GDPR. The ICO lists lost or stolen computing devices as one of its examples. Whether you must report it is a separate question, and it turns on risk to the people whose data was on the machine.
The ICO’s guide to personal data breaches sets three rules worth knowing:
-
Report within 72 hours if there is likely to be a riskThe clock runs from when you become aware of the breach, not from when you finish investigating. If you are late, you must explain why.Check: who in the business decides, and are they reachable at a weekend?
-
Record every breach, reported or notIf you decide a risk is unlikely, you do not have to report, but you should document the facts, the effects, what you did and why you decided not to report.Check: keep a breach log, even a simple shared spreadsheet.
-
Tell the affected people if the risk is highWhere a breach is likely to result in a high risk to individuals, they must be told directly and without undue delay, with practical advice on protecting themselves.Check: do you know whose data was on this laptop?
In practice, a laptop that you can show was encrypted, locked and signed out of cloud services is often a case for recording rather than reporting, because the data is unreadable. An unencrypted laptop holding customer records, HR files or health information usually points the other way. The decision is yours to make and justify, and our guide on what to do after a data breach walks through the reporting process if you do need to file.
Police, insurance and the paper trail
If the laptop was stolen, report the theft to the police, either online through the local force or on 101, and get a crime reference number. Insurers usually ask for one, and it gives you an independent timestamp for your incident record. If it was simply left somewhere, check the lost property service of the train operator, venue or taxi firm before assuming the worst.
Then update the paperwork. Mark the device as lost in your IT asset register with the date, the user and the crime reference. Delete its entry from Windows Autopilot if it was registered there, so a thief cannot re-enrol it as a company machine after a reset. Keep the Intune and Entra records until the case is closed, because they hold the serial number and encryption status you may need to prove later.
If the laptop turns up again, do not just hand it back. You cannot know what happened to it while it was gone. Wipe it, rebuild it as if it were new, and only then return it to the user.
What to have in place before it happens
Everything above is quicker and calmer when the groundwork is already done. The difference between a lost work laptop being a non-event and a reportable breach is mostly decided months earlier, when the laptop was set up.
-
Every laptop enrolled in managementWithout enrolment there is no wipe, no locate and no record of encryption. Building it into the setup process, as our IT onboarding checklist does, means no machine leaves the office unmanaged.Check: compare your Intune device list with the laptops you actually own.
-
BitLocker enforced by policyAn encryption policy pushed from Intune, with recovery keys escrowed to Microsoft Entra ID, rather than relying on each user to switch it on.Check: Intune’s encryption report should show no unencrypted Windows laptops.
-
Files in OneDrive and SharePoint, not on the desktopKnown Folder Move redirects Desktop, Documents and Pictures to OneDrive, so a replacement laptop has the user’s files back within hours.Check: ask one user to sign in to a spare machine and see what is missing.
-
Location allowed before it is neededIntune can only locate a Windows laptop if a location policy was applied beforehand. Decide whether you want this, tell staff, and set it up deliberately.Check: test Locate device on one laptop now.
-
A one-page lost device procedureWho staff call, at any hour, and the steps the person taking the call follows. Staff should know that reporting quickly is what matters, and that nobody gets in trouble for it.Check: can a new starter find the number in under a minute?
Most of this is part of Microsoft 365 Business Premium, which includes Intune and Entra ID P1. If you already pay for it and have not set it up, the work is in configuration, not new licences. Our Microsoft 365 support covers device enrolment, BitLocker policy and OneDrive redirection as part of a standard setup.
Frequently asked questions
Can we wipe a laptop that is switched off?
Not until it is switched on and connected. Intune queues the wipe and runs it the next time the laptop checks in, which may be never if a thief keeps it offline. That is why the protection that matters is encryption, set up in advance. The wipe is a second line, useful when a finder powers it up on a network.
Should the employee pay for a lost work laptop?
That depends on their employment contract and your written policy, not on IT. Deductions from pay for lost equipment need to be allowed by the contract or agreed in writing in advance, so check with HR or an employment adviser before raising it. From a security point of view, any hint of blame makes people slower to report the next loss.
What if the laptop was the employee’s own device?
You cannot wipe a personal laptop that the business does not manage. You can still reset the password and revoke sessions, which cuts off Microsoft 365. If the business uses app protection policies, you can remove company data from managed apps such as Outlook and OneDrive without touching personal files.
Do we need to tell our clients?
Only if their personal data was on the laptop and the breach is likely to result in a high risk to them, or if your contract with them requires notification. Many supplier agreements do, often within a shorter window than the ICO’s 72 hours. Check your client contracts as part of the same incident review.
A lost laptop is one of the most common incidents a small business will deal with, and one of the easiest to make harmless in advance. Enrol your devices, enforce encryption and keep files in the cloud, and the next time someone leaves a bag on a train the job is a password reset and a new machine.
Make the Next Lost Laptop a Non-Event
We set up device encryption, management and a clear incident procedure so a missing laptop is a quick, recorded fix rather than a breach.
